How often does this go wrong: multiple dhcp servers on your subnet? Because routers, accesspoints, modems boxes ALL have dhcp servers nowadays, a double or triple dhcp server in your network is not uncommon. But tools to identify which dhcp servers are available are not easy to find.
To identify that something might be wrong, you can use ipconfig on a windows cmd box:
C:\Documents and Settings\rvw.KOEKJE>ipconfig /all
Windows IP-configuratie
…
Ethernet-adapter LAN-verbinding:
…
Standaardgateway. . . . . . . . . : 10.237.147.2
DHCP-server . . . . . . . . . . . : 10.237.147.50
DNS-servers . . . . . . . . . . . : 213.51.129.37
213.51.144.37
etc
This shows you your CURRENT dhcp server, but if there are multiple dhcp servers running by accident, you will get an IP address from a RANDOM server!
Same with NETSH. The command NETSH DIAG SHOW DHCP only shows your CURRENT dhcp server and does not do a scan.
Even utilities that claim to do this, only show one or only the current dhcp. DHCPexplorer from nsasoft is such a fake application.
Fortunately there is a tool that comes standard with windows, called DHCPLOC. If it is not installed, you can find it on your windows CD under the \support\tools directory OR get it from
here
Give your current IP address as an argument to dhcploc, and press “d” (discover). Press d a few times to get a good view.
C:\WINDOWS>dhcploc 10.237.147.101
15:28:30 OFFER (IP)10.237.147.199 (S)10.237.147.50 ***Form
15:28:32 OFFER (IP)10.237.147.170 (S)10.237.147.1 ***
15:28:32 OFFER (IP)10.237.147.199 (S)10.237.147.50 ***
15:28:34 OFFER (IP)10.237.147.199 (S)10.237.147.50 ***
15:28:35 OFFER (IP)10.237.147.170 (S)10.237.147.1 ***
15:28:35 OFFER (IP)10.237.147.199 (S)10.237.147.50 ***
15:28:36 OFFER (IP)10.237.147.170 (S)10.237.147.1 ***
15:28:37 OFFER (IP)10.237.147.199 (S)10.237.147.50 ***
There! there is a rogue dhcp server running at IP 10.237.147.1 !!
So you know.
(the rogue dhcp server turned out to be a netopia dsl router, which only changes dhcp server settings after a REBOOT! Shame!)
Edit:
Another nice tool is DHCPFIND.EXE, from roadkil. Its free and works, and is a GUI tool, not a commandline tool. Only problem is that it does not show the dhcp server IP, so dhcploc is still the best utility for the job. If you want to try dhcpfind, look here